Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704) ยท updates https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703 Two flaws in the Xen hypervisor's grant copy operation let a malicious guest VM read and write arbitrary memory belonging to other domains, including dom0, breaking VM isolation on the host. Xen caches already-validated data during batches of grant copies on the same page, but re-validated it incorrectly: frame numbers and grant references could be mixed up (CVE-2026-102703), and the check limiting copy-by-frame-number to the caller's own memory was misplaced (CVE-2026-102704). Every Xen version from 4.6 onward is vulnerable and there is no mitigation. The Xen Project published patches for xen-unstable through 4.17.x on Nov 3 2026; XCP-ng 8.3 and Qubes OS 4.3 shipped fixed packages that need a host or dom0 reboot, while Debian stable releases were still listed as vulnerable on Nov 4. Found by Anthropic using Claude and validated by Ada Logics; no exploitation has been reported. en Tue, 03 Nov 2026 00:00:00 GMT Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704): Xen Project publishes XSA-523 (CVE-2026-102703, CVE-2026-102704) with patches for xen-unstable through Xen 4.17.x; no known mitigation. https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703 https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703#2026-11-03-9266f683 Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://xenbits.xen.org/xsa/advisory-523.html">Source</a></p> Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704): XCP-ng releases xen-4.17.7-4.2.xcpng8.3 and Qubes OS publishes fixed Xen 4.19.6-3 packages for Qubes 4.3; both require a host or dom0 reboot. https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703 https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703#2026-11-03-bf084938 Tue, 03 Nov 2026 00:00:00 GMT critical <p><a href="https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html">Source</a></p>